Scenario: video-on-demand streaming

The app decides who may watch; transcoders, storage and the CDN move the bytes, and the bill is the bytes viewers receive.

Before you read: predict

ExamHall's proctoring review plays a candidate's 2-hour webcam recording to one reviewer from the CDN: a master playlist, one media playlist and 1,200 six-second segments at 0.5 Mbit/s. Recordings are private. The reviewer watches without pausing; 31 minutes in, she copies the address her player is using and forwards it, and a friend opens it at minute 42. The team wants no recording bytes through the app servers, the reviewer to see all 1,200 segments, and the friend refused.

On this lesson's signing-CDN model, which design does that?

The 30-second version

Say watched hours × bitrate first: egress, not servers, shapes the design. Processing: one job per chunk and rung, playlists from finished segments, the master last, and nothing published ever changes. Delivery: the CDN carries every byte; the app checks who may watch and signs the video's path, renewed while she watches.

The app decides who may watch; transcoders, storage and the CDN move the bytes, and the bill is the bytes viewers receive.

How it works

Step 1 of 11

Estimate first. Egress is hours watched × the bitrate viewers receive; storage is hours uploaded × every rung's bitrate. Viewing outweighs uploading, so egress decides.

In the kitchen

the big bill is shipping heavy bottles to every grocer, not the cellar → egress, not storage (steps 1, 11)

Analogy: A maple sugarhouse

Each spring the sugarhouse boils its sap into syrup, bottles it and ships it to the grocers on its list.

At the sugarhouse	In video on demand
each season's syrup is bottled in 250 ml, 500 ml and 1-litre bottles	the rungs of the ladder (step 3)
each batch carries its own number, and a sealed bottle is never refilled	published files never change (step 6)
a grocer's standing account covers every size, and is renewed each spring	one signature for the whole video (step 9)
the big bill is shipping heavy bottles to every grocer, not the cellar	egress, not storage (steps 1, 11)

Breaks down when: a grocer orders one size all season, while a player may change rung at every segment (fsd-sc-video-player).

Contrasting case: a sugarhouse that makes every grocer collect each order at its own door. Nothing leaves unchecked, and the sugarhouse handles every crate: the app relaying video (step 2).

In real terms: the app carries decisions, the CDN carries bytes, and the bill follows the bits viewers receive.

Examples, run for real

4.1 ExamHall EXH-4720: the review app that carried every byte

ExamHall's proctoring review checked the reviewer's login, then relayed each recording from storage through the app servers. One sitting is 2,400 recordings of 2 hours, each reviewed once.

4.1 before: the app relays every recording from storage · 2,400 recordings × 2 h × 0.5 Mbit/s · through the app servers per sitting: 1,080 GB
4.1 MR !5020: each recording's path signed for 10 minutes, renewed every 5 · through the app servers: 0 GB · signing calls: 24 a recording, 57,600 a sitting · the CDN delivers 1,080 GB

MR !5020 signs each recording's path for 10 minutes and the player renews it every 5; the app servers carry no recording bytes (steps 2, 8–9).

4.2 Stored once, sent many times (ticketing)

A ticketing site keeps 300 concert films of 2 hours on three rungs; its venue app plays only the 2 Mbit/s rung.

4.2 300 films × 2 h on rungs of 4.5, 2 and 0.8 Mbit/s: stored 1,971 GB · 50,000 hours watched in a month at 2 Mbit/s: sent 45,000 GB, 23 times what is stored

Storage pays for every rung once; egress pays for the rung viewers receive, every hour they watch (steps 1, 10).

Try it

Answer first, then check. Nothing is saved.

Question 1 of 6

A ticketing site streams recorded concerts to ticket holders. Last month they watched 40,000 hours: a quarter of those hours at the 6 Mbit/s rung, half at 3 Mbit/s and a quarter at 1 Mbit/s; nobody watched the ladder's 0.5 Mbit/s rung.

With 8 bits to a byte and 1 TB = 10¹² bytes, how much did the CDN deliver?

Question 2 of 6

A ticketing site's 2-hour concert film is published as version 1 under /films/88/v1/, and its audio is faulty. The team re-encodes it as version 2 under /films/88/v2/. When a viewer presses play, the app signs the path of the version the catalogue names, valid 3 hours; no player renews it. The team wants no step to read a file that does not exist yet, no viewer ever to request a missing file, and v1's files gone at the end.

On this lesson's replacement model, in what order should the team do these five things?

Your order

1empty
2empty
3empty
4empty
5empty

Tap the lines in the order you expect.

Question 3 of 6

In a design round you said the CDN carries every byte and an origin shield sits in front of storage. The interviewer says: "Finance says the CDN's delivery bill is our biggest line. Last month 1,000,000 hours were watched, at $0.02 a GB delivered. Phones watched 60% of the hours, at the 5 Mbit/s 1080p rung, on screens that show no more than 720p (the 2.5 Mbit/s rung); big screens, which show 1080p, watched 30% at 1080p; slow links watched 10% at the 1.2 Mbit/s 480p rung, one above the 0.7 Mbit/s 360p rung." She wants that bill cut by at least a quarter without lowering the picture anyone can see.

On this lesson's delivery-bill model, which answer survives?

Question 4 of 6

A ticketing site's 2-hour concert film is published on one rung as 1,200 six-second segments, and its audio is faulty. Instead of publishing a new version, the team rewrites the segments in place, in film order, one a second: segment 1 at 20:00:01, segment 1,200 at 20:20:00. All day, one viewer presses play every minute on the minute and watches to the end without pausing; her player requests each segment as she reaches it, with nothing fetched ahead, and every request reads the file storage holds at that second.

On this lesson's replacement model, how many viewers hear both the old and the new audio?

Question 5 of 6

A chat community app transcodes each uploaded class recording into four rungs. On one worker, a minute of source takes 2 minutes to encode at 1080p, 1 minute at 720p, 30 seconds at 480p and 15 seconds at 360p. A 90-minute recording is cut into 2-minute chunks, and each chunk-and-rung pair is one job. 100 workers take jobs from one queue, every 1080p job first, then 720p, 480p and 360p.

On this lesson's transcode-farm model, how many minutes after the jobs are queued is every rung of the recording encoded?

Question 6 of 6

A payments company expects 50,000 people to watch its 2-hour results webcast replay at once, at an average of 4 Mbit/s; players fetch one 6-second segment at a time. Each app server's network link carries 10 Gbit/s in each direction, and a server handles 5,000 requests a second.

If the app servers fetched the video from storage and relayed it, how many would the replay need?

Go deeper

Pro tips

Estimate watched hours × bitrate before you design anything. When: the first minutes of a video round, before choosing a server, a queue or a codec (step 1). Verify:
```
tip 2,400 recordings × 2 h = 4,800 watched hours × 0.5 Mbit/s × 0.45 GB per Mbit/s-hour = 1,080 GB a sitting, delivered however the app is built
```
Status: RAN.

Source

quote-check.mjs finds every passage below verbatim in its saved text. The row names exactly these two sources. Valid as of 2026-10-17.

R. Pantos, W. May, RFC 8216, HTTP Live Streaming (August 2017): https://www.rfc-editor.org/rfc/rfc8216.txt (rfc8216.txt). The row's first source, a standard. Quoted: "A Media Segment is specified by a URI and optionally a byte range."; "A Master Playlist provides a set of Variant Streams, each of which describes a different version of the same content."; "Any Media Segment that is specified in a Playlist loaded by a client MUST be available for immediate download, or playback errors can occur."; "If the EXT-X-PLAYLIST-TYPE value is Video On Demand (VOD), the Media Playlist cannot change."; "The EXT-X-ENDLIST tag indicates that no more Media Segments will be added to the Media Playlist file."; "It represents the peak segment bit rate of the Variant Stream." Supports steps 3, 5, 6 and 8, and the replacement model's rule that playlists are written from finished segments.
Evan King, Hello Interview, Design a Video Streaming Platform Like YouTube: https://www.hellointerview.com/learn/system-design/problem-breakdowns/youtube (hellointerview-youtube.txt). The row's second source. Quoted: "Multi-gigabyte video files bypass application servers entirely using presigned URLs for direct S3 uploads, with resumable chunked transfers and CDN distribution."; "if all the data (manifest files and segments) was in the CDN, then the service would never need to interact with the backend at all to continue streaming a video."; "The read-to-write ratio is extreme - viral videos might be watched millions of times but uploaded only once."; "The segment processing (transcoding, audio processing, transcription) can be done in parallel on different worker nodes since there's no dependencies between segments"; "Create manifest files referencing the different segments in different video formats." Supports steps 1–5 and the tip.

Steps 7, 9, 10 and 11 are this lesson's models and arithmetic, not quoted rules: the signing CDN (lib/models.mjs, cdnAllows) is a model of signed paths checked per request, not any vendor's product; neither row source describes signed playback, so no key rests on a vendor's documentation. The 0.45 GB per Mbit/s-hour is arithmetic (10⁶ × 3,600 ÷ 8 bytes).

Checked against the tools and docs as of 2026-10-17.

Predict first